Jenkins Open Redirect Vulnerability

An open redirect vulnerability has been identified in Jenkins versions through 2.499 and LTS versions through 2.492.1. In these versions, redirects starting with backslash characters are treated as safe, allowing attackers to perform phishing attacks. This is possible because browsers interpret backslashes as part of scheme-relative redirects, enabling the redirection to an external site.

Impact

Exploitation of this vulnerability could lead to phishing attacks, where users are redirected to malicious sites without their knowledge.

Remediation

Users of Jenkins weekly versions should update to version 2.500, and users of Jenkins LTS should update to version 2.492.2. These versions include the necessary fix for this vulnerability.